GSI于May 9，2012发布EnCase v7.04版本
- 增加“备份”面板，可以对每个Case的具体Backup进行管理
- 完善备份功能，支持任务备份、自动备份等多种方式
- File Carver优化
- Report Templates Display Additional Fields
- iOS 5.0 and iOS 5.1 iPhone and iPad Device Support
- Internet Explorer 9 History Updates Support
- Firefox 8 History Updates Support
- Evidence Processor 性能优化，主要针对keyword search
- 加密格式支持更新：Sophos SafeGuard Enterprise and Easy v5.5 and v5.6、McAfee EndPoint Encryption v6.0 for Windows and Macintosh
- Passware整合更新：更新为支持Passware 11.7
- Review Package Allows Export of Native Files
BUG Fixed
Acquisition/Add Device/Preview/File System
48027: The YAFFS2 file system for acquired HTC Android phones cannot be read correctly,
resulting in blank text and hex views.
48469: After an acquisition, the File Acquired column is not populated, even though the evidence
file contains the correct value.
48498: When trying to rebuild a RAID 5 configuration with a null device, the new device does not
appear in the Evidence tab.
48838: Logical acquisition of Android phones fails.
Bookmarking
48391: Swept bookmarks made in the transcript view are not displayed in the report.
49055: Selecting Bookmark Data in Bookmark view may cause EnCase to crash.
Date Handling
46182: Custom date formats set in EnCase Global Options display correctly in Encase; however,
conditions using the same format result in a "date is out of range" error.
48145: The date and type are not correctly updated on bookmarked files that have had modified
time zone settings.
48312: Time zone changes are not maintained when reopening a case.
48493: After bookmarking the Evidence Processor logs, some of the dates and times display
incorrectly in the report view.
Doc/Transcript
48415: EnCase occasionally crashes or fails to display when viewing or indexing a UTF-8-
encoded document.
Email/Compressed Files/Archived Files
47310: When compressed view is enabled, navigating to the text or hex tab in the view pane
causes the selected text to be deselected.
48607: When viewing email attachments, the logical size of the attachment in the table view is
inconsistent with the attachment size in the Report tab.
48736: EnCase crashes when trying to mount Camtasia studio recorder (.camrec) compound files.
EnCase Processor
48599: The Create Package option is not available in EnCase Processor.
Encryption
48601: Decrypting Credant files causes EnCase to crash.
EnScript
44896: In the EnScript edit window. Ctrl+left or right arrow changes tabs instead of turning on word
break.
48555: Launching Case Analyzer occasionally takes longer than expected.
49164: While parsing $logs, EnCase may crash.
Evidence Processor
47161: A customer image file of an XP machine causes EnCase to crash when running Evidence
Processor. This happens when only the hashing and recover folders options are turned on, and
happens when parsing PST files.
47971: In Evidence Processor, block size errors are generated when values with incorrect upper
limits are entered.
Export Files/Folders/Export to Mail Format
48097: When exporting keywords, selecting Only Checked Rows exports only one line of data.
48428: When using a Save As command to export blue checked files in the table view, the
exported file contains excessive white space in the cells.
49035, 49160: When using a non-default folder for exporting Passware files, EnCase does not
warn the user that the folder already contains data. EnCase overwrites existing Passware data.
Filters/Conditions/Queries
45070: When doing a new Raw Search, the dialog shows two new keyword buttons when the tree
view is clicked.
48229: When searching in the index or when used in a condition, the Signature tag is set to
require an integer value instead of a string.
48495: When saving a condition, the URL Host Name field changes to URL Host.
48635: When creating entry conditions, some string fields are being displayed and treated as
integers.
48911: A date condition cannot find a file if the Local TZ checkbox is cleared.
Hashing/Searching/File Signatures/Signature Analysis
47997: The hash sets column shows true if the file matches a hash value that is not enabled in the
hash library. Although the hash set column in the table pane shows true, the hash set in the
bottom pane is empty.
48168: When hashing files, the SHA512 hashing protocol does not work.
48264: Search hits and items are displayed inconsistently in results list.
48528: After conducting an index search, the results view loses focus when using Go To File to
view a file in its original location.
48535: When specifying search terms, sub-categories cannot be appropriately selected from a list.
48536: Sub-category entries are being treated like keywords and appearing as search hits.
Index/Query Index
48641, 48855: When indexing evidence from large cases with multiple evidence files, EnCase
may fail.
SAFE
48888: The SAFE 7b and 7c servlet crashes when attempting to collect from a Windows 7
machine.
UI/Controls/Configuration
48104: When working with search results across partitioned devices, the next and previous hit
buttons do not function correctly.
48314: When looking at records for a PST file using the tree view, the previous and next item
buttons do not work.
